{"id":"CVE-2026-118475","kind":"vulnerability","aliases":["CVE-2026-118475"],"related":[],"title":"Eye of GNOME: malformed PNG color profile can crash viewer or leak memory","description":"A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.","summary":"Eye of GNOME, the GNOME image viewer, mishandles a PNG file with malformed color profile metadata and reads past a buffer. An attacker who tricks a user into opening the image can crash the app or possibly expose nearby memory.","severity":"low","cvss":3.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eye-of-gnome","gnome","linux-desktop","png","runtime"],"not_affected_if":["no-eog-installed","trusted-images-only"],"how_to_check":"- Check the installed Eye of GNOME version, for example with `eog --version`, and compare it against the fixed version once a source states one.","fix":null,"status":"open","published_at":"2026-10-30T02:17:08+00:00","first_seen_at":"2026-10-30T02:28:05+00:00","triaged_at":"2026-10-30T02:30:10+00:00","updated_at":"2026-10-30T02:30:10+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-30T02:30:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Eye of GNOME: malformed PNG color profile can crash viewer or leak memory","impact":"low","summary":"Eye of GNOME, the GNOME image viewer, mishandles a PNG file with malformed color profile metadata and reads past a buffer. An attacker who tricks a user into opening the image can crash the app or possibly expose nearby memory.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["eye-of-gnome","gnome","linux-desktop","png"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Application crashes or leaks sensitive memory contents to the attacker","analyst_note":"","how_to_check":"- Check the installed Eye of GNOME version, for example with `eog --version`, and compare it against the fixed version once a source states one.\n- unknown","plain_action":"Be careful about opening image files you did not expect from people you do not know, and install any Eye of GNOME update your Linux distribution offers.","needs_analyst":false,"not_affected_if":["no-eog-installed","trusted-images-only"],"who_is_affected":"Anyone who opens untrusted PNG files in Eye of GNOME on a desktop Linux system is exposed, since the attack needs a user to open a crafted image. Systems that do not run Eye of GNOME, or only open images from trusted sources, are at lower risk. The sources do not name affected versions.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000685,"input_tokens":4144,"output_tokens":542,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-118475':16A,19A '-2026':15A,18A 'alloc':121C 'app':64B 'applic':91C,116C,129C 'attack':52B,104C 'boundari':96C 'buffer':50B,122C 'caus':114C 'chunk':95C 'color':6A,43B,87C 'contain':85C 'content':143C 'could':105C 'craft':82C 'crash':9A,62B,130C 'cve':14A,17A 'denial':134C 'desktop':27B 'dos':137C 'expos':67B,140C 'eye':1A,21B,30B,75C 'eye-of-gnom':20B 'fail':92C 'file':40B 'flaw':71C 'found':73C 'gnome':3A,23B,24B,32B,34B,77C 'imag':35B,60B,84C,113C 'issu':124C 'lead':126C 'leak':12A 'linux':26B 'linux-desktop':25B 'malform':4A,42B,86C 'malici':112C 'memori':13A,69B,142C 'metadata':45B,89C 'mishandl':37B 'nearbi':68B 'null':101C 'open':58B,110C 'pars':79C 'past':48B,119C 'png':5A,28B,39B,83C 'possibl':66B 'potenti':139C 'profil':7A,44B,88C 'read':47B,118C 'result':131C 'runtim':29B 'search':98C 'sensit':141C 'servic':136C 'special':81C 'termin':102C 'trick':54B,106C 'user':56B,108C 'valid':94C 'viewer':10A,36B","nicknames":[],"mitigations":[],"who_affected":"Anyone who opens untrusted PNG files in Eye of GNOME on a desktop Linux system is exposed, since the attack needs a user to open a crafted image. Systems that do not run Eye of GNOME, or only open images from trusted sources, are at lower risk. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Be careful about opening image files you did not expect from people you do not know, and install any Eye of GNOME update your Linux distribution offers.","first_public_at":"2026-10-30T02:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118475","severity":null,"published_at":"2026-10-30T02:17:08+00:00","modified_at":"2026-10-30T02:17:08+00:00","first_seen_at":"2026-10-30T02:28:05+00:00","fetched_at":"2026-10-30T02:28:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}